Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-01-2022 18:09
Static task
static1
Behavioral task
behavioral1
Sample
lionlee.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
lionlee.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
lionlee.exe
-
Size
113KB
-
MD5
3bd42085584a11f32b619102c57eba91
-
SHA1
6ece11c3efec83e33b4acc1458aa62953891c420
-
SHA256
6e0f7705c589e4fbfdd1b6c1431a675aa58b863a06448aaade026463f55024ff
-
SHA512
dba8345d5697bfe778c7737c2f8d23bcb7dc092be253055608eb32785a73d87acc49c649d633ba59eaa6bed313962838b23823fa928610e6aa65dacf451d71df
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 2 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 576 firefox.exe 576 firefox.exe 576 firefox.exe 576 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 576 firefox.exe 576 firefox.exe 576 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
lionlee.exepid process 1588 lionlee.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 1556 wrote to memory of 576 1556 firefox.exe firefox.exe PID 576 wrote to memory of 1440 576 firefox.exe firefox.exe PID 576 wrote to memory of 1440 576 firefox.exe firefox.exe PID 576 wrote to memory of 1440 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 288 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe PID 576 wrote to memory of 540 576 firefox.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lionlee.exe"C:\Users\Admin\AppData\Local\Temp\lionlee.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="576.0.62599320\677459764" -parentBuildID 20200403170909 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 1 -prefMapSize 219799 -appdir "C:\Program Files\Mozilla Firefox\browser" - 576 "\\.\pipe\gecko-crash-server-pipe.576" 1248 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="576.3.52805084\605817292" -childID 1 -isForBrowser -prefsHandle 1712 -prefMapHandle 1672 -prefsLen 156 -prefMapSize 219799 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 576 "\\.\pipe\gecko-crash-server-pipe.576" 1068 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="576.13.1287140460\1106641419" -childID 2 -isForBrowser -prefsHandle 2736 -prefMapHandle 2732 -prefsLen 7013 -prefMapSize 219799 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 576 "\\.\pipe\gecko-crash-server-pipe.576" 2748 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="576.14.1437995235\1197024914" -childID 3 -isForBrowser -prefsHandle 2756 -prefMapHandle 2736 -prefsLen 7013 -prefMapSize 219799 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 576 "\\.\pipe\gecko-crash-server-pipe.576" 2828 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="576.21.1221496815\155219799" -childID 4 -isForBrowser -prefsHandle 3352 -prefMapHandle 3348 -prefsLen 7718 -prefMapSize 219799 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 576 "\\.\pipe\gecko-crash-server-pipe.576" 3364 tab3⤵